Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 09:29
Static task
static1
Behavioral task
behavioral1
Sample
biliecrypt.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
biliecrypt.exe
Resource
win10v2004-20240419-en
General
-
Target
biliecrypt.exe
-
Size
820KB
-
MD5
c83c118e38053dfee03489bc21014ca8
-
SHA1
b88174774ad323be8397d5816059e84c61d04bfe
-
SHA256
411ffa492ccbdd5b4a3431d85d107aa78333b836f2e3eb5b36ae33ab5454f8db
-
SHA512
dcfc37c64b8b28e36ecf3e24ba89f377d797619d59910234b30b5c38bfbd18ac11096f177ce994917d8384b5969f4448d331d8b36454ba2db54d5a7702d222f4
-
SSDEEP
12288:e+rzlQYypmBwGXjdX32ogZ+g/yHpZmBa2HzY+5Bvnq/Rv1R:HvlQYypmB3XZnMZ4Wkwtn+Rt
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.ionos.es - Port:
587 - Username:
[email protected] - Password:
HJBKsdaad578457@@176586 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\windows\\windows.exe" InstallUtil.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
biliecrypt.exedescription pid process target process PID 2984 set thread context of 2720 2984 biliecrypt.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
biliecrypt.exeInstallUtil.exepid process 2984 biliecrypt.exe 2984 biliecrypt.exe 2720 InstallUtil.exe 2720 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
biliecrypt.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2984 biliecrypt.exe Token: SeDebugPrivilege 2720 InstallUtil.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
biliecrypt.exedescription pid process target process PID 2984 wrote to memory of 2720 2984 biliecrypt.exe InstallUtil.exe PID 2984 wrote to memory of 2720 2984 biliecrypt.exe InstallUtil.exe PID 2984 wrote to memory of 2720 2984 biliecrypt.exe InstallUtil.exe PID 2984 wrote to memory of 2720 2984 biliecrypt.exe InstallUtil.exe PID 2984 wrote to memory of 2720 2984 biliecrypt.exe InstallUtil.exe PID 2984 wrote to memory of 2720 2984 biliecrypt.exe InstallUtil.exe PID 2984 wrote to memory of 2720 2984 biliecrypt.exe InstallUtil.exe PID 2984 wrote to memory of 2720 2984 biliecrypt.exe InstallUtil.exe PID 2984 wrote to memory of 2720 2984 biliecrypt.exe InstallUtil.exe PID 2984 wrote to memory of 2720 2984 biliecrypt.exe InstallUtil.exe PID 2984 wrote to memory of 2720 2984 biliecrypt.exe InstallUtil.exe PID 2984 wrote to memory of 2720 2984 biliecrypt.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\biliecrypt.exe"C:\Users\Admin\AppData\Local\Temp\biliecrypt.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2720-20-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2720-18-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2720-12-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2720-14-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2720-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2720-29-0x0000000004A50000-0x0000000004A90000-memory.dmpFilesize
256KB
-
memory/2720-28-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/2720-24-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/2720-8-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2720-10-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2720-25-0x0000000004A50000-0x0000000004A90000-memory.dmpFilesize
256KB
-
memory/2720-22-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2984-4-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/2984-3-0x0000000001FF0000-0x0000000002034000-memory.dmpFilesize
272KB
-
memory/2984-1-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/2984-0-0x0000000000B10000-0x0000000000BE4000-memory.dmpFilesize
848KB
-
memory/2984-23-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/2984-2-0x0000000002040000-0x0000000002080000-memory.dmpFilesize
256KB
-
memory/2984-7-0x00000000008B0000-0x00000000008B6000-memory.dmpFilesize
24KB
-
memory/2984-6-0x0000000000560000-0x000000000057A000-memory.dmpFilesize
104KB
-
memory/2984-5-0x0000000002040000-0x0000000002080000-memory.dmpFilesize
256KB